Selected reading
Primary and authoritative sources that inform BROCS, organized by the capabilities they support.
This selected list favors primary sources and links to a free canonical copy when one exists. Each entry names the capabilities it informs. Pages with factual claims cite their sources directly, and incident sources appear in the failure-mode library.
The adjacent disciplines
These publications define the established practices that BROCS adapts to enterprise AI.
Feeds B
DORA software delivery performance metrics
DORA defines change lead time, deployment frequency, recovery time, change fail rate, and deployment rework rate. BROCS applies these measures to AI applications and to approved delivery paths used outside software engineering.
Google SRE books
The books define service-level objectives, error budgets, golden signals, incident response, and postmortems. BROCS retains those operating practices and adds measures for model behavior, token use, and tool calls.
Feeds S
The FinOps Framework
FinOps allocation, budgeting, and unit economics apply to inference spend. AI workloads also need runtime limits because retry loops can change cost before a monthly report is produced.
CNCF Platforms White Paper
The paper covers self-service, reusable platform capabilities, secure defaults, and reduced cognitive load. These practices support Build and Run without tying them to one AI tool.
Operating AI already in use
These sources address operational maturity, production AI, lifecycle management, and the shared capabilities needed after adoption is underway.
Google Cloud AI and ML operational excellence
The guidance covers deployment, management, governance, automation, monitoring, and reduced operational complexity for production AI and ML systems.
Microsoft guidance for managing AI
The guidance covers operating processes, deployment governance, monitoring, cost, data, continuity, and model management across the AI lifecycle.
Microsoft GenAIOps for existing MLOps investments
The guide extends MLOps to prompts, orchestration, grounding data, indexes, evals, deployment, and production monitoring for generative AI workloads.
DORA platform engineering
DORA connects AI delivery speed with shared, self-service, standardized, and secure platform paths that reduce bottlenecks after code is produced.
Security and governance
These sources define AI security risks, reported incidents, and governance obligations.
Feeds S
OWASP Top 10 for LLM Applications
The 2025 list defines risks including prompt injection, improper output handling, excessive agency, supply-chain weaknesses, and unbounded consumption. Use it to structure threat modeling and security review.
AI Incident Database
This public incident database is one source for the failure-mode library. Verify each database record against the linked primary report before relying on it.
Feeds S
NIST AI Risk Management Framework
AI RMF 1.0 organizes risk management under Govern, Map, Measure, and Manage. BROCS maps Map and Measure to Observe, Manage to Control, and Govern to Secure. This crosswalk is an interpretation.
Feeds S
EU AI Act (Regulation 2024/1689)
This is the official text of Regulation (EU) 2024/1689. Article 12 sets logging requirements for high-risk AI systems, while other obligations depend on the system's classification and the organization's role.
Evidence for the theses
These reports, disclosures, and decisions support claims used elsewhere on the site.
Cisco 2024 Data Privacy Benchmark Study
The shadow AI numbers: 48 percent of organizations admitted entering non-public company information into generative AI tools, 27 percent banned the tools at least temporarily. A survey of 2,600 privacy and security professionals.
Wiz Research: the exposed DeepSeek database
Wiz documented an unauthenticated ClickHouse instance containing more than one million log lines, including chat history and API keys. It shows why vendor-side storage and logging belong in a security review.
Feeds S
EchoLeak: zero-click prompt injection in production (arXiv:2509.10540)
The paper documents a zero-click prompt injection path through email content read by an assistant. It supports treating retrieved content as untrusted input.
Moffatt v. Air Canada, 2024 BCCRT 149
The tribunal held Air Canada responsible for inaccurate information produced by its customer-service chatbot. The decision supports review and control of deployed AI responses.